From nobody Sat Sep 26 11:48:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBEDC517BA1; Thu, 17 Sep 2026 13:06:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789650383; cv=none; b=TWUWjHq1gg27NNQuxkw1b8ziwjsKpwKjGjUJWn9Xqpz46xH9hiDSuxC2AuKcHRdMgHMTi7xt9JFj8OMUF+W7vh7YTtkDdOg8qMqMLIEE9/JRFgitlvGoiD/0c7WuoDhPxF8Ka4i6RoYMFNBsh02s9/zCbTy+mH45SikYmNcE8mI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789650383; c=relaxed/simple; bh=sF/mLLG1ZZl3LSR2aID3VowAjKEVXc879Fwc96KbUHg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=R0jOHCKsRCrg3I3R47sUQx3UsTlUzPZkc4NhPxK6FV4syUbZnKlN+xOkFNXqBHNSxjabIjWRwj6OKCwZ+rKx5COha/cRED+GbdVVKJgkQtUWiCRF8whrI9pCkLyXHLXVwA8gErfRzvAelgYwe9xL1CqNl3Afu2KM1n6aqubWUV4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=a8KkZPC0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="a8KkZPC0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBECE1F00893; Thu, 17 Sep 2026 13:06:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789650374; bh=SNMCW68SqYp0pSeHZ5srnhkw/FExK5Pj/HQ4DdW2I8I=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=a8KkZPC02/GTvfdXxcRFwel5iS729NkpbvcGdYTkVAJjoUxp/yOVeLfGmuUpkmzKM D3iOf7bitDRgAtrqjVODhHIoBIRA6RPZ/z9PErify/o7WSEEbNrIwN4NNnwVgBu+Lq 8F/QsKs62k4qmXMUZyvEk4FXzHRy+U8kQdIflLXMlPb8oK0U3qKlRKmRnBw21pr6jy 66JuLOI5TqFrh/dJHi3ZN0smlu2oxg4XgTCzwmu+Q4MZHOBoepQX60bTu19P8snXTq YoxpakzyyUszzoE9vd67jJazh+t8rzC9QLH2oeQYkUKlkHFI55RG+8JpY4GrszNhXq xZ4vg/TztJqdQ== From: "Matthieu Baerts (NGI0)" Date: Thu, 17 Sep 2026 15:05:57 +0200 Subject: [PATCH net v2 1/3] mptcp: avoid unneeded actions on subflow reset Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-1-0cf5c72667c8@kernel.org> References: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org> In-Reply-To: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Xinyang Ge X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3596; i=matttbe@kernel.org; h=from:subject:message-id; bh=qUWthSuufu0ZncDmyc4KJwzky04oj3Rw/23POGuDd50=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJWP92/REjbVvFvusrhoN6DtmYss+Zvf9jue0z0sbVgw pftahInOkpZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACayu4fhv8Nj6+0/Pzxa1bE4 oPneHe/T1Zka9wRmJMzbtETEtK3pGDvD/8LjwpeqRSebXTF9VXtFtNI679dUjY5p4tfvcKWsK2p I5QcA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it. Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption") Cc: stable@vger.kernel.org Reported-by: Xinyang Ge Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- v2: - rewording to please Clashiko - consume skb before dss_corruption, and purge queue during reset --- net/mptcp/protocol.c | 4 ++-- net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 11 +++++++++++ 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 8dc25ef1542c..d9fc3be9d2db 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -856,12 +856,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mpt= cp_sock *msk, mptcp_dss_corruption(msk, ssk); } } else { + sk_eat_skb(ssk, skb); + if (unlikely(!fin)) { DEBUG_NET_WARN_ON_ONCE(1); mptcp_dss_corruption(msk, ssk); } - - sk_eat_skb(ssk, skb); } =20 WRITE_ONCE(tp->copied_seq, seq); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 2b4c27426477..0384d6a023f9 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -585,7 +585,8 @@ struct mptcp_subflow_context { is_mptfo : 1, /* subflow is doing TFO */ close_event_done : 1, /* has done the post-closed part */ mpc_drop : 1, /* the MPC option has been dropped in a rtx */ - __unused : 9; + resetting : 1, /* subflow is resetting */ + __unused : 8; bool data_avail; bool scheduled; bool pm_listener; /* a listener managed by the kernel PM? */ diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 01db7edce18a..f0a6725d2c37 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -438,6 +438,10 @@ void mptcp_subflow_reset(struct sock *ssk) /* must hold: tcp_done() could drop last reference on parent */ sock_hold(sk); =20 + subflow->resetting =3D 1; + + /* No need to delay the actual close for to-be discarded data. */ + __skb_queue_purge(&ssk->sk_receive_queue); mptcp_send_active_reset_reason(ssk); tcp_done(ssk); if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags)) @@ -1883,6 +1887,13 @@ static void subflow_state_change(struct sock *sk) =20 __subflow_state_change(sk); =20 + /* Rx queue processing is unneeded, error reporting will take place at + * __mptcp_close_ssk() time and subflow reset can't happen in case of + * fallback: subflow_sched_work_if_closed() would be a no-op. + */ + if (subflow->resetting) + return; + /* as recvmsg() does not acquire the subflow socket for ssk selection * a fin packet carrying a DSS can be unnoticed if we don't trigger * the data available machinery here. --=20 2.55.0 From nobody Sat Sep 26 11:48:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33233513576; Thu, 17 Sep 2026 13:06:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789650385; cv=none; b=dw8qtIq6mQ8b5NVHJ4H1ZSOt3Hw5BXY22ucASOvKxaqhgvuNNhWvh10/zrowZJTjOKJl4z2H8/k+4bKxOX3jxsgk8rFXHPHZ0jWoeoHao1CCycw9DLmYGFWpnYg9FxlSM8Mu8zbxKtiXBVdoW4W35Wv1hm1P7ECbTyhshTi7C1s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789650385; c=relaxed/simple; bh=9w+WvPJ3aYLp6/wS57Jaw4mb7DboOndjnFZXPTxC+Io=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=FnGFkUIWTfiHkCdX5JYmEdTNuNBjpEm2D+hYYMCu+58Gmph3UUx/MFjKqZNsz4r8qXHNlvcYXkDkoSM8P1kISqMfTDXI4s5zQxYawCDo9XMCBnEsIXAzN1WpAoqNcbwizTldwrTm9dS/m6CxImTqMK8Y7Frr6fuAUzQ/2QifWWw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=S0G4MVG0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="S0G4MVG0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DE891F00898; Thu, 17 Sep 2026 13:06:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789650377; bh=ZKTqy+1rn/oN3Z6QFh4uh2VTISqwBFW4uCXZoAX0i+w=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=S0G4MVG0RK6xFMse93B3m1CE6bQOgHD4vfy2AXzWTgXDcxsjsMKPOmgF3JRZ7kka9 BSPpdXThzmIA1QFyfpvpNMitA2gts2XA5qxRk8Eo+Vde8FtOwXOa26XJvzwb4Yy7+3 ySnrzgeLHc1Qb5YeAk2kkjTYiePdKKGDBXZNhw5VlOWp9Cr3LTmwn+GnN/0XDHa3Y2 GBiDJyOnuIv1n02nTT6by8b5G/KVBM0G81/ke0Pr7L5J67d3w3Tcrkfab0uuP7sp4o n/iZRAWY7iQ18tvvhafNeksm+CrU/P17spo8n9ghDI2yuKkH1Za5H6SFXBhAwsxz3s wmR7aQFSmCkFA== From: "Matthieu Baerts (NGI0)" Date: Thu, 17 Sep 2026 15:05:58 +0200 Subject: [PATCH net v2 2/3] mptcp: close race between scheduler and state change Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-2-0cf5c72667c8@kernel.org> References: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org> In-Reply-To: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Shardul Bankar , Xinyang Ge X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1369; i=matttbe@kernel.org; h=from:subject:message-id; bh=Ola5B1/PLL6OtlWpXMLg0kumciF1N+qOuxhUivE0uDw=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJWPz0whecR74ugGXZzChc9XvbANaOBRyRn6/9b31a6m nw42n+qvaOUhUGMi0FWTJFFui0yf+bzKt4SLz8LmDmsTCBDGLg4BWAiu4sZfrMudCxxORqoXfgh rOQXU85aszQDrYYVk0JOqisKPwg5f43hv9MyhZ3/jhQ7bPuvIFnDs21bg9irFTylj/lXVdhIC31 nZgAA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario. Fixes: c886d70286bf ("mptcp: do not queue data on closed subflows") Cc: stable@vger.kernel.org Reported-by: Shardul Bankar Reported-by: Xinyang Ge Closes: https://lore.kernel.org/20260525194828.1137119-1-shardul.b@mpiricso= ftware.com Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index d9fc3be9d2db..577d0134b9ec 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1664,7 +1664,9 @@ struct sock *mptcp_subflow_get_send(struct mptcp_sock= *msk) =20 static void mptcp_push_release(struct sock *ssk, struct mptcp_sendmsg_info= *info) { - tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, info->size_goal); + if (info->mss_now) + tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, + info->size_goal); release_sock(ssk); } =20 --=20 2.55.0 From nobody Sat Sep 26 11:48:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95D93514775; Thu, 17 Sep 2026 13:06:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789650390; cv=none; b=k+tjXv3FwrpiHYHFRGWqNgHRMS8PMcZIcDTICRjfB68zYCK7fy2/XUCOBxTbI++MWyJNRIIQdmVhAFTJLGo1ttaMTqZ1gt88nLpCBlgjsWaQ6xvJTDTjVK5wxfbwXHVmYRIo3ycZuuUvCqH3pi0r3oRrXHXlMav/W96bQvQ6els= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789650390; c=relaxed/simple; bh=YvY8L1roEAhWvwCvpso0WcPH5j2XlLAVWe//WqcF0zA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=LUwZrJk4OktI3bNmCym2KhgGIbBtDYjc8ILCKbsTiRu+iRsux6KyKdEFYxHkYsaMcnoKuMKz/X76x0YUzhxkJl98UXzhKcllijCCw9lP6cNJC5ooUh4zzYKSQ5WV3MQYaHta0qKuRelUtm7c3CkGAXLi/LrXzGEjhnZwfrIF22o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CfKRyw+z; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CfKRyw+z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9F071F00899; Thu, 17 Sep 2026 13:06:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789650379; bh=vc7qfZCRUlMpAR7yCuZ/u0K6XBb5KY58zoxdAw8kDtI=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=CfKRyw+zBetItN6A0QtrT9RpgGI7mVoCr0j8fRccdMAjj57Q4mORQaRN77Mg/YXiO WiZUP65EF+/N6YPoVnNKv7VbTon903/cvFmKwzqwunxRIpUqjNZsrIvZXts5LxV5iY aD+yQiPn5vsxMF7Pe+Qc78lNPD5SN7O+py9k8YE074jVBFDiYogWI0EtalmMh8DEtz MXmbnG+GRlgbg09ROVO9XXo3P6m0fm15w9o+vxYiu9kSXm/PotH8KETluXHTUE3/5G PIL+yd5hSXt9J92UTe2ifrlgzobpyPviVattXD+UpVj6r22iKc8TkWafaaXUNxLNvQ Bpo5pJSIf1pDA== From: "Matthieu Baerts (NGI0)" Date: Thu, 17 Sep 2026 15:05:59 +0200 Subject: [PATCH net v2 3/3] mptcp: fix bad accounting in __mptcp_subflow_push_pending() Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-3-0cf5c72667c8@kernel.org> References: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org> In-Reply-To: <20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=941; i=matttbe@kernel.org; h=from:subject:message-id; bh=SgypPxpJWWqrPzXbB0Ymof8bd1pKOxlUAs4CVycduFE=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJWPz0Y4XrtmCa/hIKUjqXjQ441bOJqcXeT3t45x9xto d6X2OveUcrCIMbFICumyCLdFpk/83kVb4mXnwXMHFYmkCEMXJwCMJEAPYa/Yu/lLKSz+jrnOO3O 3FIuq5y/4WKvrt2vlW4n76xunLP8GcNfAfnJx5Vbu+98/Z++9amO4swHhRU9czcuUrt6k3mpwCs mRgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni If __subflow_push_pending() errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on. Fixes: 0fa1b3783a17 ("mptcp: use get_send wrapper") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 577d0134b9ec..e89a69ab927c 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1854,7 +1854,8 @@ static void __mptcp_subflow_push_pending(struct sock = *sk, struct sock *ssk, bool ret =3D __subflow_push_pending(sk, ssk, &info); if (ret <=3D 0) keep_pushing =3D false; - copied +=3D ret; + else + copied +=3D ret; } =20 mptcp_for_each_subflow(msk, subflow) { --=20 2.55.0